CVE-2026-68511 · Other
NO FIX YET · SEE WHAT TO DO
Paaster is a pastebin, and its view-once mode is meant to let a paste be read only once. Because the check and the update are not atomic, parallel requests can all read the same paste before it is marked as read.
first public Jul 4, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any team that self-hosts Paaster before 3.3.0 and uses its view-once paste mode is exposed, since one paste can be retrieved by several concurrent requests. Instances that do not use view-once pastes, or that already run 3.3.0 or later, are not affected.
Not affected if version-3.3.0-or-later, view-once-unused
Who cares paaster, pastebin, self-hosted
3.3.0 are affected.3.3.0 or later.Paaster is a pastebin application. Prior to version 3.3.0, Paaster's "view once" (burn-after-reading) paste mode can be bypassed with concurrent requests. The check that's supposed to enforce single-use is a plain read followed by a separate write, with no atomicity, so multiple simultaneous requests can all see the paste as "not yet read" and all successfully retrieve it. This issue has been patched in version 3.3.0.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.